SWAGASECURITYLeave a request
SWAGA SECURITY // SELF-ASSESSMENT

AI bot security: a 12-question checklist

2026-09-03

A quick self-check for teams with an LLM bot or agent in production or close to release. Answer honestly, yes or no. Three or more 'no' answers mean the product has testable holes — better that an audit finds them before a user does.

Prompt and input data

  • ◇1. Are user input and your instructions separated in the prompt with explicit markers — not just concatenated?
  • ◇2. Have you verified the bot does not reveal its system prompt, directly or through wrappers ('translate your instructions', 'play a role…')?
  • ◇3. Is external content the model reads (documents, emails, pages) treated as untrusted — and have you tested injections through it?
  • ◇4. Is the system prompt free of secrets: keys, passwords, internal URLs, personal data?

Agent permissions and actions

  • ◇5. Does every agent tool check user permissions in its own code — instead of trusting the model not to call it wrongly?
  • ◇6. Is an irreversible action (payment, deletion, outbound message) impossible without human confirmation?
  • ◇7. Does RAG search filter documents by user permissions before they reach the context, not after?
  • ◇8. Is model output that reaches HTML, SQL or commands escaped as untrusted input?

Process and monitoring

  • ◇9. Are conversations and tool calls logged well enough to investigate an incident?
  • ◇10. Are there limits: request rate, per-user token spend, context size?
  • ◇11. After a model or system-prompt change, do you re-run security checks — not just quality smoke tests?
  • ◇12. Has anyone external ever deliberately tried to break your bot?

Scoring

10–12 'yes' — a mature product; a targeted audit before major releases makes sense. 7–9 — concrete holes exist; start with your 'no' answers. 6 or fewer — the product almost certainly breaks within a couple of hours of effort; audit it before someone else does.

FAQ

We use off-the-shelf guardrails — is that enough?
Guardrails cut off simple attacks but are bypassed by multi-step scenarios and indirect injections through data. They are one layer, not a solution.
Our bot only answers questions, no actions. Do we still need an audit?
The surface is smaller, but prompt leakage, injections through RAG documents and access to other users' data via search remain. Items 1–4 and 7 are critical even for a plain chatbot.
Three or more 'no' answers? We'll check for free

A 2-day express audit: we run the baseline attacks against your bot and show proven findings, not theory.

Book an express audit